github-mirrors/logstash
1
0
Fork 0
mirror of https://github.com/elastic/logstash.git synced 2025-04-24 14:47:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

More fixes to use new grok lib

Browse source
This commit is contained in:
Suyog Rao 2014-08-11 11:47:43 -07:00
parent 8351fbd401
commit d7bb4df9bf
1 changed files with 19 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

79
lib/logstash/filters/grok.rb
View file

@ -263,7 +263,7 @@ class LogStash::Filters::Grok < LogStash::Filters::Base
grok = Grok.new grok = Grok.new
grok.logger = @logger unless @logger.nil? grok.logger = @logger unless @logger.nil?
add_patterns_from_files(@patternfiles, grok) add_patterns_from_files(@patternfiles, grok)
grok.compile(pattern) grok.compile(pattern, @named_captures_only)
@patterns[field] << grok @patterns[field] << grok
end end
end # @match.each end # @match.each
@ -320,76 +320,35 @@ class LogStash::Filters::Grok < LogStash::Filters::Base
matched = false matched = false
groks.each do |grok| groks.each do |grok|
# Convert anything else to string (number, hash, etc) # Convert anything else to string (number, hash, etc)
match = grok.match(input.to_s) matched = grok.match_and_capture(input.to_s) do |field, value|
if match
match.each_capture do |capture, value|
handle(capture, value, event)
end
matched = true matched = true
break if @break_on_match handle(field, value, event)
end end
break if matched and @break_on_match
end end
return matched return matched
end end
private private
def handle(capture, value, event) def handle(field, value, event)
handler = @handlers[capture] ||= compile_capture_handler(capture) return if (value.nil? || (value.is_a?(String) && value.empty?)) unless
return handler.call(value, event) @keep_empty_captures
end
private
def compile_capture_handler(capture)
# SYNTAX:SEMANTIC:TYPE
syntax, semantic, coerce = capture.split(":")
# each_capture do |fullname, value|
# capture_handlers[fullname].call(value, event)
# end
code = []
code << "# for capture #{capture}"
code << "lambda do |value, event|"
#code << " p :value => value, :event => event"
if semantic.nil?
if @named_captures_only
# Abort early if we are only keeping named (semantic) captures
# and this capture has no semantic name.
code << " return"
else
field = syntax
end
else
field = semantic
end
code << " return if value.nil? || value.empty?" unless @keep_empty_captures
if coerce
case coerce
when "int"; code << " value = value.to_i"
when "float"; code << " value = value.to_f"
end
end
code << " # field: #{field}"
if @overwrite.include?(field) if @overwrite.include?(field)
code << " event[field] = value" event[field] = value
else else
code << " v = event[field]" v = event[field]
code << " if v.nil?" if v.nil?
code << " event[field] = value" event[field] = value
code << " elsif v.is_a?(Array)" elsif v.is_a?(Array)
code << " event[field] << value" event[field] << value
code << " elsif v.is_a?(String)" elsif v.is_a?(String)
# Promote to array since we aren't overwriting. #puts v, value
code << " event[field] = [v, value]" # Promote to array since we aren't overwriting.
code << " end" event[field] = [v, value]
end
end end
code << " return" end
code << "end"
#puts code
return eval(code.join("\n"), binding, "<grok capture #{capture}>")
end # def compile_capture_handler
private private
def add_patterns_from_files(paths, grok) def add_patterns_from_files(paths, grok)